Resilient Response in Complex Systems John Allspaw SVP, Tech Ops - - PowerPoint PPT Presentation

Resilient Response in Complex Systems

John Allspaw SVP, Tech Ops

OPERABILITY

PRODUCTION

http://whoownsmyavailability.com

How important is this?

How important is this?

How Can This Happen?

Complicated? Complex?

Complex Systems

• Cascading Failures
• Difficult to determine boundaries
• Complex systems may be open
• Complex systems may have a memory
• Complex systems may be nested
• Dynamic network of multiplicity
• May produce emergent phenomena
• Relationships are non-linear
• Relationships contain feedback loops

1998

How Can This Happen? It does happen. And it will again. And again.

Optimization

MTBF MTTR

http://www.flickr.com/photos/sparktography/75499095/

How does team troubleshooting happen?

Time Problem Starts Detection Evaluation Response Stable Confirmation All Clear

PostMortem

Time Problem Starts Detection Evaluation Response Stable Confirmation All Clear

Stress

PostMortem

Forced beyond learned roles Actions whose consequences are both important and difficult to see Cognitively and perceptively noisy Coordinative load increases exponentially

So What Can We Do?

We Learn From Others

Characteristics of response to escalating scenarios

...tend to neglect how processes develop within time (awareness of rates) versus assessing how things are in the moment

Characteristics of response to escalating scenarios

“On the Difficulties People Have in Dealing With Complexity” Dietrich Doerner, 1980

...have difficulty in dealing with exponential developments (hard to imagine how fast something can change, or accelerate)

Characteristics of response to escalating scenarios

“On the Difficulties People Have in Dealing With Complexity” Dietrich Doerner, 1980

...inclined to think in causal series, instead of causal nets. A therefore B, instead of A, therefore B and C (therefore D and E), etc.

Characteristics of response to escalating scenarios

“On the Difficulties People Have in Dealing With Complexity” Dietrich Doerner, 1980

Thematic Vagabonding

Pitfalls

Pitfalls

Goal Fixation (encystment)

Pitfalls

Refusal to make decisions

Non-communicating lone wolf-isms

Heroism

Irrelevant noise in comm channels

Distraction

Jens Rasmussen, 1983

Senior Member, IEEE “Skills, Rules, and Knowledge; Signals, Signs, and Symbols, and Other Distinctions in Human Performance Models”

IEEE Transactions On Systems, Man, and Cybernetics, May 1983

SKILL - BASED

Simple, routine

RULE - BASED

Knowable, but unfamiliar

KNOWLEDGE - BASED

WTF IS GOING ON?

(Reason, 1990)

Team Dynamics

• Air Traffic Control
• Naval Air Operations At Sea
• Electrical Power Systems
• Etc.

High Reliability Organizations

• Complex Socio-Technical

systems

• Efficiency <-> Thoroughness
• Time/Resource Constrained
• Engineering-driven

“The Self-Designing High-Reliability Organization: Aircraft Carrier Flight Operations at Sea”

Rochlin, La Porte, and Roberts. Naval War College Review 1987

Close interdependence between groups

Close reciprocal coordination and information sharing, resulting in overlapping knowledge

High redundancy: multiple people observing the same event and sharing information

Broad definition of who belongs to the team.

Teammates are included in the communication loops rather than excluded.

Lots of error correction.

High levels of situation comprehension: maintain constant awareness of the possibility of accidents.

High levels of interpersonal skills

Maintenance of detailed records of past incidents that are closely examined with a view to learning from them.

Patterns of authority are changed to meet the demands of the events:

• rganizational flexibility.

The reporting of errors and faults is rewarded, not punished.

So What Else Can We Do?

We Drill

We GameDay

We Learn To Improvise

IMPROVISATION

IMPROVISATION

We Learn From Our Mistakes

Postmortems

• Full timelines: What happened, when
• Review in public, everyone invited
• Search for “second stories” instead of “human error”
• Cultivating a blameless environment
• Giving requisite authority to individuals to improve things

High signal:noise in comm channels? Troubleshooting fatigue? Troubleshooting handoff? All tools on-hand? Improvised tooling or solutions? Metrics visibility? Collaborative and skillful communication?

Qualifying Response

Remediation

Mature Role of Automation

http://www.bainbrdg.demon.co.uk/Papers/Ironies.html “Ironies of Automation” - Lisanne Bainbridge

Mature Role of Automation

• Moves humans from manual operator to supervisor
• Extends and augments human abilities, doesn’t replace it
• Doesn’t remove “human error”
• Are brittle
• Recognize that there is always discretionary space for humans
• Recognizes the Law of Stretched Systems

Law of Stretched Systems

“Every system is stretched to operate at its capacity; as soon as there is some improvement, for example, in the form of new technology, it will be exploited to achieve a new intensity and tempo of activity”

D. Woods, E. Hollnagel, “Joint Cognitive Systems: Patterns” 2006

We Share Near-Miss Events

Near Misses

Hey everybody -

Don’t be like me. I tried to X, but that wasn’t a good idea. It almost exploded everyone.

So, don’t do: (details about X) Love, Joe

• Can act like “vaccines” - help system safety without actually

hurting anything

• Happen more often, so provide more data on latent failures
• Powerful reminder of hazards, and slows down the process of

forgetting to be afraid

Near Misses

A parting word A parting challenge

Two Propositions

100 changes 6 change-related issues

100 > 6

Proposition #1

“Ways in which things go right are special cases

• f the ways in which things go wrong.”

Proposition #1

Successes = failures gone wrong Study the failures, generalize from that. Potential data sources: 6 out of 100

Proposition #2

“Ways in which things go wrong are special cases of the ways in which things go right.”

Proposition #2

Failures = successes gone wrong Study the successes, generalize from that Potential data sources: 94 out of 100

94/100 ? 6/100 ?

OR

What and WHY Do Things Go RIGHT?

Not just:

why did we fail?

But also:

why did we succeed?

Resilient Response

• Can learn from other fields
• Can train for outages
• Can learn from mistakes
• Can learn from successes as well as failures

http://www.flickr.com/photos/sparktography/75499095/

THE END